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(57) Abstract: There is disclosed a system for detecting virus infec- 
tion in a network and preventing the virus infection. Decoy means 
(13, 14, 15) accessible via the network (1) are arranged on a storage 
device (12). The system includes: communication information anal- 
ysis means (16) for detecting virus intrusion into the decoy means 
(13, 14, 15) and upon detection of the virus intrusion, detecting a 
computer as a source of the virus from the communication informa- 
tion acquired upon the virus intrusion; and computer attack means 
(17) for performing virus attack process to the virus source computer 
for suppressing action of the virus via the network. Attack of the 
computer attack means (17) by a monitoring computer (10) is con- 
tinued until a computer (5) infected with virus is identified and the 
virus is removed by an administrator. 
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IU2 

Network worm warning from 192.168.10.254 
Date 2002/12/25 
Time: 11:30:45 
Target Node: 192.168.10.15 
FQDN Name : I nf ector . i nf ect. com 
NetBIOS name: I nf ector 
Username: Virus 

Detected request: /default, i da?NNNNNNNNNNNNNNNNNNNNN 
NNNNNNNNNNNNNNNNNNNNNNNNNN^ 
NNNNNNNNNNNNNNNNIWNNNNNNN^ 



NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNh^ 

%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090 

% u 9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a 

Current status: Attacking 

Arp information 
<Arp result> 
Ping information 
<Ping result> 
NBTSTAT information 
<NBTSTAT result> 
Net stat information 
<Netstat information> 



(a) 

UpIxI 



Network worm warning from 192.168.10.254 

Date 2002/12/25 

Time: 11:30:45 

Target Node: 192. 168. 10. 15 

FQDN Name: Infector.infect.com 

NetBIOS name: Inf ector 

Username: Virus 

Detected path: C:¥l¥Windows¥notepad. exe 
Current status: Attacking 

Arp information 
<Arp result> 
Ping information 
<Ping result> 
NBTSTAT information 
<NBTSTAT result> 
Netstat information 
<Netstat information> 

(b) ~ 
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